Description
Docker daemon fails to start when userns-remap requires the getent binary call and the username or groupname contains space. This is particularly the case when using docker in an LDAP/Active Directory environment where the GID is domain users
Steps to reproduce the issue:
Content of /etc/subuid
Content of /etc/subgid
domain users:1266401153:65536
Describe the results you received:
sudo dockerd -D -H tcp://127.0.0.1:2375 --userns-remap="user:domain users"
INFO[2020-08-19T10:26:59.288868661+02:00] Starting up
Error during groupname lookup for "domain users": getent unable to find entry "domain" in group database
Describe the results you expected:
Docker daemon should be able to parse group/user with space when calling getent
Additional information you deem important (e.g. issue happens only occasionally):
The issue relies in the way the getent is called by the execCmd function. The args string is simply splat using " " delimiter which leads to an issue when groupname or username contain space. My first guess is to change the definition of the args from the exeCmd function to take an []string instead of just a string
func execCmd(cmd, args []string) ([]byte, error) {
}Furthermore, the LookupGroup function should escape the groupname with \ character. I guess that the following replacement will make the trick
func LookupGroup(groupname string) (user.Group, error) {
// first try a local system files lookup using existing capabilities
group, err := user.LookupGroup(groupname)
if err == nil {
return group, nil
}
// local files lookup failed; attempt to call `getent` to query configured group dbs
// old : return getentGroup(fmt.Sprintf("%s %s", "group", groupname))
return getentGroup(fmt.Sprintf("%s %s", "group", strings.Replace(groupname, " ", "\\ ", -1)))
}Output of docker version:
Client: Docker Engine - Community
Version: 19.03.12
API version: 1.40
Go version: go1.13.10
Git commit: 48a66213fe
Built: Mon Jun 22 15:45:50 2020
OS/Arch: linux/amd64
Experimental: false
Server: Docker Engine - Community
Engine:
Version: 19.03.12
API version: 1.40 (minimum version 1.12)
Go version: go1.13.10
Git commit: 48a66213fe
Built: Mon Jun 22 15:44:21 2020
OS/Arch: linux/amd64
Experimental: false
containerd:
Version: 1.2.13
GitCommit: 7ad184331fa3e55e52b890ea95e65ba581ae3429
runc:
Version: 1.0.0-rc10
GitCommit: dc9208a3303feef5b3839f4323d9beb36df0a9dd
docker-init:
Version: 0.18.0
GitCommit: fec3683
Output of docker info:
Client:
Debug Mode: false
Server:
Containers: 13
Running: 0
Paused: 0
Stopped: 13
Images: 89
Server Version: 19.03.12
Storage Driver: overlay2
Backing Filesystem: extfs
Supports d_type: true
Native Overlay Diff: true
Logging Driver: json-file
Cgroup Driver: cgroupfs
Plugins:
Volume: local
Network: bridge host ipvlan macvlan null overlay
Log: awslogs fluentd gcplogs gelf journald json-file local logentries splunk syslog
Swarm: inactive
Runtimes: runc
Default Runtime: runc
Init Binary: docker-init
containerd version: 7ad184331fa3e55e52b890ea95e65ba581ae3429
runc version: dc9208a3303feef5b3839f4323d9beb36df0a9dd
init version: fec3683
Security Options:
apparmor
seccomp
Profile: default
Kernel Version: 4.19.0-10-amd64
Operating System: Debian GNU/Linux 10 (buster)
OSType: linux
Architecture: x86_64
CPUs: 8
Total Memory: 31.08GiB
Name: maxime-port.lin.ariane.network
ID: X5OZ:FT2A:DR5P:JUFG:T3TH:XPUS:NOFF:AVEQ:EPTJ:UJBK:ABSU:5WV2
Docker Root Dir: /var/lib/docker
Debug Mode: false
Registry: https://index.docker.io/v1/
Labels:
Experimental: false
Insecure Registries:
127.0.0.0/8
Live Restore Enabled: false
Additional environment details (AWS, VirtualBox, physical, etc.):
Laptop with a user part of an Active Directory environment.
getent passwd user
user:*:1266401166:1266401166:John Doe:/home/doe:/bin/bash
getent group domain\ users
domain users:*:1266400513:
Description
Docker daemon fails to start when userns-remap requires the
getentbinary call and the username or groupname contains space. This is particularly the case when using docker in an LDAP/Active Directory environment where the GID isdomain usersSteps to reproduce the issue:
Content of /etc/subuid
Content of /etc/subgid
Describe the results you received:
Describe the results you expected:
Docker daemon should be able to parse group/user with space when calling getent
Additional information you deem important (e.g. issue happens only occasionally):
The issue relies in the way the
getentis called by the execCmd function. The args string is simply splat using" "delimiter which leads to an issue when groupname or username contain space. My first guess is to change the definition of the args from the exeCmd function to take an []string instead of just a stringFurthermore, the LookupGroup function should escape the
groupnamewith\character. I guess that the following replacement will make the trickOutput of
docker version:Output of
docker info:Additional environment details (AWS, VirtualBox, physical, etc.):
Laptop with a user part of an Active Directory environment.